mirror of
https://github.com/kubescape/kubescape.git
synced 2026-03-23 11:57:25 +00:00
Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
16cd30bea8 | ||
|
|
485e171008 | ||
|
|
c12eb83b4b | ||
|
|
84060e7823 | ||
|
|
d80d50b59d | ||
|
|
f11f054fea | ||
|
|
4c1d491d5a | ||
|
|
2b67cc520c | ||
|
|
2a5712bd3c |
37
README.md
37
README.md
@@ -15,6 +15,8 @@ Use Kubescape to test clusters or scan single YAML files and integrate it to you
|
||||
curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash
|
||||
```
|
||||
|
||||
[Install on windows](#install-on-windows)
|
||||
|
||||
## Run:
|
||||
```
|
||||
kubescape scan framework nsa --exclude-namespaces kube-system,kube-public
|
||||
@@ -39,6 +41,20 @@ Want to contribute? Want to discuss something? Have an issue?
|
||||
|
||||
# Options and examples
|
||||
|
||||
## Install on Windows
|
||||
|
||||
**Requires powershell v5.0+**
|
||||
|
||||
``` powershell
|
||||
iwr -useb https://raw.githubusercontent.com/armosec/kubescape/master/install.ps1 | iex
|
||||
```
|
||||
|
||||
Note: if you get an error you might need to change the execution policy (i.e. enable Powershell) with
|
||||
|
||||
``` powershell
|
||||
Set-ExecutionPolicy RemoteSigned -scope CurrentUser
|
||||
```
|
||||
|
||||
## Flags
|
||||
|
||||
| flag | default | description | options |
|
||||
@@ -99,7 +115,7 @@ for example:
|
||||
```
|
||||
helm template bitnami/mysql --generate-name --dry-run | kubescape scan framework nsa -
|
||||
```
|
||||
### Offline Support <img src="docs/new-feature.svg">
|
||||
### Offline Support
|
||||
|
||||
It is possible to run Kubescape offline!
|
||||
|
||||
@@ -119,7 +135,24 @@ Kubescape is an open source project, we welcome your feedback and ideas for impr
|
||||
|
||||
# How to build
|
||||
|
||||
## For development
|
||||
## Build using python script
|
||||
|
||||
Kubescpae can be built using:
|
||||
|
||||
``` sh
|
||||
python built.py
|
||||
```
|
||||
|
||||
Note: In order to built using the above script, one must set the environment
|
||||
variables in this script:
|
||||
|
||||
+ RELEASE
|
||||
+ ArmoBEServer
|
||||
+ ArmoERServer
|
||||
+ ArmoWebsite
|
||||
|
||||
|
||||
## Build using go
|
||||
|
||||
Note: development (and the release process) is done with Go `1.16`
|
||||
|
||||
|
||||
82
build.py
Normal file
82
build.py
Normal file
@@ -0,0 +1,82 @@
|
||||
import os
|
||||
import sys
|
||||
import hashlib
|
||||
import platform
|
||||
import subprocess
|
||||
|
||||
BASE_GETTER_CONST = "github.com/armosec/kubescape/cautils/getter"
|
||||
BE_SERVER_CONST = BASE_GETTER_CONST + ".ArmoBEURL"
|
||||
ER_SERVER_CONST = BASE_GETTER_CONST + ".ArmoERURL"
|
||||
WEBSITE_CONST = BASE_GETTER_CONST + ".ArmoFEURL"
|
||||
|
||||
def checkStatus(status, msg):
|
||||
if status != 0:
|
||||
sys.stderr.write(msg)
|
||||
exit(status)
|
||||
|
||||
|
||||
def getBuildDir():
|
||||
currentPlatform = platform.system()
|
||||
buildDir = "build/"
|
||||
|
||||
if currentPlatform == "Windows": buildDir += "windows-latest"
|
||||
elif currentPlatform == "Linux": buildDir += "ubuntu-latest"
|
||||
elif currentPlatform == "Darwin": buildDir += "macos-latest"
|
||||
else: raise OSError("Platform %s is not supported!" % (currentPlatform))
|
||||
|
||||
return buildDir
|
||||
|
||||
def getPackageName():
|
||||
packageName = "kubescape"
|
||||
if platform.system() == "Windows": packageName += ".exe"
|
||||
|
||||
return packageName
|
||||
|
||||
|
||||
def main():
|
||||
print("Building Kubescape")
|
||||
|
||||
# print environment variables
|
||||
print(os.environ)
|
||||
|
||||
# Set some variables
|
||||
packageName = getPackageName()
|
||||
buildUrl = "github.com/armosec/kubescape/cmd.BuildNumber"
|
||||
releaseVersion = os.getenv("RELEASE")
|
||||
ArmoBEServer = os.getenv("ArmoBEServer")
|
||||
ArmoERServer = os.getenv("ArmoERServer")
|
||||
ArmoWebsite = os.getenv("ArmoWebsite")
|
||||
|
||||
# Create build directory
|
||||
buildDir = getBuildDir()
|
||||
|
||||
if not os.path.isdir(buildDir):
|
||||
os.makedirs(buildDir)
|
||||
|
||||
# Get dependencies
|
||||
try:
|
||||
status = subprocess.call(["go", "mod", "tidy"])
|
||||
checkStatus(status, "Failed to get dependencies")
|
||||
|
||||
except OSError:
|
||||
print("An error occured: (Hint: check if go is installed)")
|
||||
raise
|
||||
|
||||
# Build kubescape
|
||||
ldflags = "-w -s -X %s=%s -X %s=%s -X %s=%s -X %s=%s" \
|
||||
% (buildUrl, releaseVersion, BE_SERVER_CONST, ArmoBEServer,
|
||||
ER_SERVER_CONST, ArmoERServer, WEBSITE_CONST, ArmoWebsite)
|
||||
status = subprocess.call(["go", "build", "-o", "%s/%s" % (buildDir, packageName), "-ldflags" ,ldflags])
|
||||
checkStatus(status, "Failed to build kubescape")
|
||||
|
||||
|
||||
sha1 = hashlib.sha1()
|
||||
with open(buildDir + "/" + packageName, "rb") as kube:
|
||||
sha1.update(kube.read())
|
||||
with open(buildDir + "/" + packageName + ".sha1", "w") as kube_sha:
|
||||
kube_sha.write(sha1.hexdigest())
|
||||
|
||||
print("Build Done")
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -10,4 +10,7 @@ RUN GOOS=linux CGO_ENABLED=0 go build -ldflags="-s -w " -installsuffix cgo -o k
|
||||
FROM alpine
|
||||
COPY --from=builder /work/kubescape /usr/bin/kubescape
|
||||
|
||||
# # Download the frameworks. Use the "--use-default" flag when running kubescape
|
||||
# RUN kubescape download framework nsa && kubescape download framework mitre
|
||||
|
||||
CMD ["kubescape"]
|
||||
|
||||
@@ -189,20 +189,20 @@ func (c *ClusterConfig) SetKeyValueInConfigmap(key string, value string) error {
|
||||
|
||||
func (c *ClusterConfig) SetCustomerGUID() error {
|
||||
|
||||
// get from file
|
||||
if existsConfigJson() {
|
||||
c.configObj, _ = loadConfigFromFile()
|
||||
} else if c.existsConfigMap() {
|
||||
// get from configMap
|
||||
if c.existsConfigMap() {
|
||||
c.configObj, _ = c.loadConfigFromConfigMap()
|
||||
} else if existsConfigJson() { // get from file
|
||||
c.configObj, _ = loadConfigFromFile()
|
||||
} else {
|
||||
c.createConfigMap()
|
||||
createConfigJson()
|
||||
}
|
||||
|
||||
customerGUID := c.GetCustomerGUID()
|
||||
|
||||
// get from armoBE
|
||||
tenantResponse, err := c.armoAPI.GetCustomerGUID(customerGUID)
|
||||
|
||||
if err == nil && tenantResponse != nil {
|
||||
if tenantResponse.AdminMail != "" { // this customer already belongs to some user
|
||||
if existsConfigJson() {
|
||||
@@ -222,7 +222,7 @@ func (c *ClusterConfig) SetCustomerGUID() error {
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if err != nil && strings.Contains(err.Error(), "Invitation for tenant already exists") {
|
||||
if err != nil && strings.Contains(err.Error(), "already exists") {
|
||||
return nil
|
||||
}
|
||||
return err
|
||||
|
||||
@@ -104,13 +104,18 @@ func GetClusterName() string {
|
||||
}
|
||||
|
||||
func GetDefaultNamespace() string {
|
||||
defaultNamespace := "default"
|
||||
clientCfg, err := clientcmd.NewDefaultClientConfigLoadingRules().Load()
|
||||
if err != nil {
|
||||
return "default"
|
||||
return defaultNamespace
|
||||
}
|
||||
namespace := clientCfg.Contexts[clientCfg.CurrentContext].Namespace
|
||||
if namespace == "" {
|
||||
namespace = "default"
|
||||
apiContext, ok := clientCfg.Contexts[clientCfg.CurrentContext]
|
||||
if !ok || apiContext == nil {
|
||||
return defaultNamespace
|
||||
}
|
||||
namespace := apiContext.Namespace
|
||||
if apiContext.Namespace == "" {
|
||||
namespace = defaultNamespace
|
||||
}
|
||||
return namespace
|
||||
}
|
||||
|
||||
26
install.ps1
Normal file
26
install.ps1
Normal file
@@ -0,0 +1,26 @@
|
||||
Write-Host "Installing Kubescape..." -ForegroundColor Cyan
|
||||
|
||||
$BASE_DIR=$env:USERPROFILE + "\.kubescape"
|
||||
$packageName = "/kubescape-windows-latest"
|
||||
|
||||
# Get latest release url
|
||||
$config = Invoke-WebRequest "https://api.github.com/repos/armosec/kubescape/releases/latest" | ConvertFrom-Json
|
||||
$url = $config.html_url.Replace("/tag/","/download/")
|
||||
$fullUrl = $url + $packageName
|
||||
|
||||
# Create a new directory if needed
|
||||
New-Item -Path $BASE_DIR -ItemType "directory" -ErrorAction SilentlyContinue
|
||||
|
||||
# Download the binary
|
||||
Invoke-WebRequest -Uri $fullUrl -OutFile $BASE_DIR\kubescape.exe
|
||||
|
||||
# Update user PATH if needed
|
||||
$currentPath = [Environment]::GetEnvironmentVariable("Path", "User")
|
||||
if (-not $currentPath.Contains($BASE_DIR)) {
|
||||
$confirmation = Read-Host "Add kubescape to user path? (y/n)"
|
||||
if ($confirmation -eq 'y') {
|
||||
[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$BASE_DIR;", "User")
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Finished Installation" -ForegroundColor Green
|
||||
Reference in New Issue
Block a user